Index anomaly detection method and apparatus, and electronic device

1. An index anomaly detection method, comprising:

acquiring, by at least one computer device connected to a network, data of each of monitoring points, contained in a period of time, of a monitored index, wherein the monitored index corresponds to at least one of payment account theft events or payment request delay in a transaction system;

extracting, by the at least one computer device, a mean value and a variance of the data of the monitoring points using a Gaussian model;

calculating by the at least one computer device, according to the mean value and the variance of the data of the monitoring points, probabilities of occurrence of the data of the monitoring points, respectively;

calculating by the at least one computer device, according to the respectively calculated probabilities, joint probabilities of occurrence of the data of the monitoring points contained in respective windows divided from the period of time; and

detecting by the at least one computer device, according to the joint probabilities corresponding to the respective windows, whether the monitored index is abnormal, and outputting a detection result when the monitored index is detected to be abnormal.

2. The method of claim 1 , wherein before acquiring data of each of monitoring points, contained in a period of time, of a monitored index, the method further comprises:

acquiring original monitoring data of each monitoring point, contained in a period of time, of the monitored index; and

taking a logarithm of the original monitoring data of each monitoring point and using the logarithm as data of each monitoring point, contained in the period of time, of the monitored index, for index anomaly detection.

3. The method of claim 1 , wherein calculating, according to the respectively calculated probabilities, joint probabilities of occurrence of the data of the monitoring points contained in respective windows divided from the period of time comprises:

determining a plurality of different windows divided from the period of time; and

respectively for each window and according to a probability, in the respectively calculated probabilities, corresponding to data of each of the monitoring points contained in a window, calculating a joint probability of occurrence of data of each of the monitoring points contained in the window.

4. The method of claim 3 , wherein dividing a plurality of different windows from the period of time comprises:

dividing a plurality of different windows from the period of time according to a set time interval and a window length, wherein a difference between starting times of adjacent windows is the time interval.

5. The method of claim 1 , wherein detecting, according to the joint probabilities corresponding to the respective windows, whether the monitored index is abnormal comprises:

using the Gaussian model for the joint probabilities to extract a mean value and a variance of the joint probabilities;

calculating, according to the mean value and the variance of the joint probabilities, a probability of occurrence of the joint probability corresponding to each of the windows, respectively; and

detecting, according to the probability of occurrence of the joint probability corresponding to a window, whether the monitored index is abnormal.

6. The method of claim 5 , wherein detecting, according to the probability of occurrence of the joint probability corresponding to the window, whether the monitored index is abnormal comprises:

detecting, according to the mean value and the variance of the joint probabilities and according to the probability of occurrence of the joint probability corresponding to the window, whether the monitored index is abnormal within the window according to a 3σ rule.

7. The method of claim 1 , wherein the Gaussian model comprises a Gaussian mixture model.

8. An electronic device, comprising:

a processor; and

a memory storing instructions executable by the processor,

wherein the processor is configured to perform:

acquiring data of each of monitoring points, contained in a period of time, of a monitored index, wherein the monitored index corresponds to at least one of payment account theft events or payment request delay in a transaction system;

extracting a mean value and a variance of the data of the monitoring points using a Gaussian model;

calculating, according to the mean value and the variance of the data of the monitoring points, probabilities of occurrence of the data of the monitoring points, respectively;

calculating, according to the respectively calculated probabilities, joint probabilities of occurrence of the data of the monitoring points contained in respective windows divided from the period of time; and

detecting, according to the joint probabilities corresponding to the respective windows, whether the monitored index is abnormal, and outputting a detection result when the monitored index is detected to be abnormal.

9. The device of claim 8 , wherein the processor is further configured to perform:

acquiring original monitoring data of each monitoring point, contained in the period of time, of the monitored index, and taking a logarithm of the original monitoring data of each monitoring point and using the logarithm as data of each monitoring point, contained in the period of time, of the monitored index, for index anomaly detection.

10. The device of claim 8 , wherein the processor is further configured to perform:

determining a plurality of different windows divided from the period of time; and

respectively for each window and according to a probability, in the respectively calculated probabilities, corresponding to data of each of the monitoring points contained in a window, calculating a joint probability of occurrence of data of each of the monitoring points contained in the window.

11. The device of claim 10 , wherein dividing a plurality of different windows from the period of time comprises:

dividing a plurality of different windows from the period of time according to a set time interval and a window length, wherein a difference between starting times of adjacent windows is the time interval.

12. The device of claim 8 , wherein the processor is further configured to perform:

using the Gaussian model for the joint probabilities to extract a mean value and a variance of the joint probabilities;

calculating, according to the mean value and the variance of the joint probabilities, a probability of occurrence of the joint probability corresponding to each of the windows; and

detecting, according to the probability of occurrence of the joint probability corresponding to a window, whether the monitored index is abnormal.

13. The device of claim 12 , wherein the processor is further configured to perform:

detecting, according to the mean value and the variance of the joint probabilities and according to the probability of occurrence of the joint probability corresponding to the window, whether the monitored index is abnormal within the window according to a 3σ rule.

14. The device of claim 8 , wherein the Gaussian model comprises a Gaussian mixture model.

15. A non-transitory computer-readable storage medium having stored therein instructions that, when executed by a processor of a device, cause the device to perform:

acquiring data of each of monitoring points, contained in a period of time, of a monitored index, wherein the monitored index corresponds to at least one of payment account theft events or payment request delay in a transaction system;

extracting a mean value and a variance of the data of the monitoring points using a Gaussian model;

calculating, according to the mean value and the variance of the data of the monitoring points, probabilities of occurrence of the data of the monitoring points, respectively;

calculating, according to the respectively calculated probabilities, joint probabilities of occurrence of the data of the monitoring points contained in respective windows divided from the period of time; and

detecting, according to the joint probabilities corresponding to the respective windows, whether the monitored index is abnormal, and outputting a detection result when the monitored index is detected to be abnormal.